MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e66fa2702c441976b520fadae630706672aea1b0ef3462fdb70a9f80265e91de. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 11


Intelligence 11 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e66fa2702c441976b520fadae630706672aea1b0ef3462fdb70a9f80265e91de
SHA3-384 hash: f4611536e89f843de156500d2f5e952b257b6285e34384c71e35b6952c38e204dda84dbab1225f06b4e827de030b6efa
SHA1 hash: d734812d4bf87aa24e3d2358af1c1f0c2d8092cc
MD5 hash: 6149deff7562a29f3a5c54371222c98b
humanhash: helium-lake-michigan-muppet
File name:EXTRACTO DE CUENTA.exe
Download: download sample
Signature AgentTesla
Create hunting rule
File size:645'120 bytes
First seen:2022-02-03 10:57:54 UTC
Last seen:2022-02-03 14:04:49 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'666 x AgentTesla, 19'479 x Formbook, 12'209 x SnakeKeylogger)
ssdeep 12288:E7mBa1WJxeVYkXZP8smxr43jG62nLnthPJWh9KLzDqJ:NBYWJxAYkJ0Lx0x2LTAeLzuJ
Threatray 14'992 similar samples on MalwareBazaar
TLSH T15BD4D076F78FCA91D455553220BEF84013B23FDBAAE3C6062B58B3490F722564E9960F
File icon (PE):PE icon
dhash icon 96d4acda6cb4dc0c (25 x AgentTesla, 12 x Formbook, 10 x Loki)
Reporter cocaman
Tags:AgentTesla exe

Intelligence

File Origin
# of uploads :
2
# of downloads :
246
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
EXTRACTO DE CUENTA (1).rar
Verdict:
No threats detected
Analysis date:
2022-02-03 16:45:49 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/835a670e-7313-4913-bf9b-9a4b64fb47d4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/232126/
Detection(s):
SecuriteInfo.com.PUA.EmbeddedEXE-1.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a window
DNS request
Unauthorized injection to a recently created process
Creating a file
Using the Windows Management Instrumentation requests
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Agent Tesla
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4bae2b64-865b-465b-a5ce-49fd04c10c55
Result
Threat name:
AgentTesla
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/933240
Behaviour
Behavior Graph:
n/a
Detection:
agenttesla
Create hunting rule
Link:
https://mwdb.cert.pl/sample/e66fa2702c441976b520fadae630706672aea1b0ef3462fdb70a9f80265e91de/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-02-03 10:35:32 UTC
File Type:
PE (.Net Exe)
Extracted files:
31
AV detection:
18 of 28 (64.29%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4zx2e4bmiqmxnnja7lnommdqmzzk5inq542gf7nxbkpyajs6shpa._file
Verdict:
malicious
Label(s):
agenttesla
Create hunting rule
Similar samples:
528a40ac4d415e0fd5d204596f78f372b11188d2ab8edfe57d111b405c0e4d8e
AgentTesla
781be46ac84b2f6bebda7e94d95e54732d218fa045d476376471853ab4bbb3ee
AgentTesla
903de95a30d55eaf9ecb49a0a310df96c215b51b25b3d3e8628adae14a94e7f0
AgentTesla
912d6ec12b68a25a9280f5b0f331aec4e9297b493faeba153bf6790fbbab65a8
AgentTesla
a12e4c0e507712a93706967e43b769ad7c23db93d70d1b184efdb97d7217bfc2
AgentTesla
a3e6ddf936423f35ad131abf8cefe5c2596b6a82b467f42449005e67b68054d2
AgentTesla
+ 14'982 additional samples on MalwareBazaar
Result
Malware family:
agenttesla
Create hunting rule
Score:
  10/10
Tags:
family:agenttesla keylogger spyware stealer trojan
Link:
https://tria.ge/reports/220203-m2xacagbbn/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of SetThreadContext
AgentTesla Payload
AgentTesla
Unpacked files
SH256 hash:
d817837759a7be218aa381509db8f814d408612b0218439095f794e1d3753267
MD5 hash:
9488a7cb21b68e344f6e3b88337c2e5f
SHA1 hash:
e7d40168578b0a4b37ab41c5689320091489f52c
Link:
https://www.unpac.me/results/a0f4449a-d4f9-468d-a285-398e33ffcb37/
SH256 hash:
dbaf193310f479f62457461a22313ce49d16cbd4f58c79757768a5157e3ac78b
MD5 hash:
d74ff468805e076baa658c7c8399ef89
SHA1 hash:
deebfdbf18e6459c60c864ba9c077cdfab706561
Link:
https://www.unpac.me/results/a0f4449a-d4f9-468d-a285-398e33ffcb37/
SH256 hash:
0cc119786b104cf0aa261a208bf38802b339774ff3d7a42afcd8329d2d7d21c9
MD5 hash:
263b5190f7ac42d83c756dcdf38147bb
SHA1 hash:
78f419fe3936ed7d603706c47230cd3e6ff79ffe
Link:
https://www.unpac.me/results/a0f4449a-d4f9-468d-a285-398e33ffcb37/
SH256 hash:
e66fa2702c441976b520fadae630706672aea1b0ef3462fdb70a9f80265e91de
MD5 hash:
6149deff7562a29f3a5c54371222c98b
SHA1 hash:
d734812d4bf87aa24e3d2358af1c1f0c2d8092cc
Link:
https://www.unpac.me/results/a0f4449a-d4f9-468d-a285-398e33ffcb37/
Malware family:
Agent Tesla v3
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/e66fa2702c44/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e66fa2702c441976b520fadae630706672aea1b0ef3462fdb70a9f80265e91de

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 12ee9b69bfd8add9a4d0114eba848c0d9d36b231130e1b7168ba594f98c82c50

AgentTesla

Executable exe e66fa2702c441976b520fadae630706672aea1b0ef3462fdb70a9f80265e91de

(this sample)

  
Delivery method
Other
  
Dropped by
SHA256 12ee9b69bfd8add9a4d0114eba848c0d9d36b231130e1b7168ba594f98c82c50
Cape
Cape
https://www.capesandbox.com/analysis/232126/

Comments